diff --git a/third_party/libopenjpeg20/0015-read_SPCod_SPCoc_overflow.patch b/third_party/libopenjpeg20/0015-read_SPCod_SPCoc_overflow.patch
new file mode 100644
index 0000000..56f0cf0
--- /dev/null
+++ b/third_party/libopenjpeg20/0015-read_SPCod_SPCoc_overflow.patch
@@ -0,0 +1,15 @@
+diff --git a/third_party/libopenjpeg20/j2k.c b/third_party/libopenjpeg20/j2k.c
+index 9056feb..c7aa8db 100644
+--- a/third_party/libopenjpeg20/j2k.c
++++ b/third_party/libopenjpeg20/j2k.c
+@@ -8744,7 +8744,9 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(  opj_j2k_t *p_j2k,
+                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
+ 
+         /* precondition again */
+-        assert(compno < p_j2k->m_private_image->numcomps);
++        if (compno >= p_j2k->m_private_image->numcomps) {
++                return OPJ_FALSE;
++        }
+ 
+         l_tccp = &l_tcp->tccps[compno];
+         l_current_ptr = p_header_data;
diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium
index 82a3754..559f1c1 100644
--- a/third_party/libopenjpeg20/README.pdfium
+++ b/third_party/libopenjpeg20/README.pdfium
@@ -24,4 +24,5 @@
 0012-mct_sse.patch: Don't use SSE intrinsics in 32-bit builds.
 0013-attrib_fix.patch: Don't needlessly redefine __attribute__, https://github.com/uclouvain/openjpeg/issues/727
 0014-opj_jp2_read_ihdr_leak.patch: Memory leak in opj_jp2_read_ihdr().
+0015-read_SPCod_SPCoc_overflow.patch: Prevent a buffer overflow in opj_j2k_read_SPCod_SPCoc.
 TODO(thestig): List all the other patches.
diff --git a/third_party/libopenjpeg20/j2k.c b/third_party/libopenjpeg20/j2k.c
index 9056feb..c7aa8db 100644
--- a/third_party/libopenjpeg20/j2k.c
+++ b/third_party/libopenjpeg20/j2k.c
@@ -8744,7 +8744,9 @@
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
 
         /* precondition again */
-        assert(compno < p_j2k->m_private_image->numcomps);
+        if (compno >= p_j2k->m_private_image->numcomps) {
+                return OPJ_FALSE;
+        }
 
         l_tccp = &l_tcp->tccps[compno];
         l_current_ptr = p_header_data;